SUSE CVE-2022-48873

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on createrprocess and devicerelease Do not remove the map from the list on error path in fastrpcinitcreateprocess, instead call fastrpcmapput, to avoid use-after-free. Do not remove it on...

SUSE CVE-2022-48881

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: Fix refcount leak in amdpmcprobe pcigetdomainbusandslot takes reference, the caller should release the reference by calling pcidevput after use. Call pcidevput in the error path to fix this...

DEBIAN-CVE-2022-48896

In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix pci device refcount leak As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pcidevput. In...

DEBIAN-CVE-2022-48881

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: Fix refcount leak in amdpmcprobe pcigetdomainbusandslot takes reference, the caller should release the reference by calling pcidevput after use. Call pcidevput in the error path to fix this...

AZL-51995 CVE-2024-43835 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix napiskbcacheput warning After the commit bdacf3e34945 "net: Use nested-BH locking for napialloccache." was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451...

DEBIAN-CVE-2024-42300

In the Linux kernel, the following vulnerability has been resolved: erofs: fix race in zerofsgetgbuf In zerofsgetgbuf, the current task may be migrated to another CPU between zerofsgbufid and spinlock&gbuf-lock. Therefore, zerofsputgbuf will trigger the following issue which was found by stress...

PT-2024-40867 · Git +1 · Pcapplusplus

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value". Technical details include a crash state involving std:: 1::ostreambuf iterator and...

kernel: stm class: Fix a double free in stm_register_device()

A vulnerability was found in the Linux kernel's stm class, where an improper memory management sequence in stmregisterdevice could lead to a double-free error. This issue occurs when the putdevice&stm-dev call triggers stmdevicerelease to free "stm", making the subsequent vfreestm call redundant...

kernel: mmc: sdio: fix possible resource leaks in some error paths

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdioaddfunc or sdioinitfunc fails, sdioremovefunc can not release the resources, because the sdio function is not presented in these two cases, it won't call ofnodeput...

kernel: mmc: sdio: fix possible resource leaks in some error paths

In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resource leaks in some error paths If sdioaddfunc or sdioinitfunc fails, sdioremovefunc can not release the resources, because the sdio function is not presented in these two cases, it won't call ofnodeput...

UBUNTU-CVE-2024-41078

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the...

Unauthorized Access

alextselegidis/easyappointments is vulnerable to Unauthorized Access. The vulnerability is due to insufficient access controls in the GET, PUT, DELETE /providers/providerId endpoints, allowing a low privileged user to fetch, modify, or delete a privileged user's data...

CVE-2024-6908 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data...

CVE-2024-6908

The CVE-2024-6908 entry concerns Yugabyte Platform, where improper privilege management allows an authenticated admin to escalate to SuperAdmin via a crafted PUT request, potentially granting access to sensitive functions and data. The described impact is unauthorized access to sensitive system c...

CVE-2024-6908 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data...

CVE-2024-6908 Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data...

PT-2024-37949 · Yugabyte · Yugabyte Platform

Name of the Vulnerable Software and Affected Versions: Yugabyte Platform affected versions not specified Description: The issue concerns improper privilege management, allowing authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request. This could lead to...

SUSE CVE-2022-48860

In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemacliteofprobe This node pointer is returned by ofparsephandle with refcount incremented in this function. Calling ofnodeput to avoid the refcount leak. As the remove function do...

SUSE CVE-2022-48775

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix memory leak in vmbusaddchannelkobj kobjectinitandadd takes reference even when it fails. According to the doc of kobjectinitandadd: If this function returns an error, kobjectput must be called to properly...

SUSE CVE-2022-48807

In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEVUNREGISTER handler Currently, the same handler is called for both a NETDEVBONDINGINFO LAG unlink notification as for a NETDEVUNREGISTER call. This is causing a problem though, since the...